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DESCRIPTION ^ 



UNAUTHORIZED -ALTERATION DETECTING METHOD, 
UNAUTHORIZEXLiAIi-TtERATXQN^DETECTING PROGRAM. AND 



RECORDING MEDIUM HAVING RECORDED THE PROGRAM 



Technical Field 

The present invention relates to unauthorized- 
10 alteration detection methods, unauthorized-alteration 
detecting programs, and recording media having recorded the 
programs, and more particularly, to a technology for 
detecting a position where an image is altered in an 
unauthorized manner, which uses fragile electronic 
15 watermarking employing number theoretic transform. 



Background Art 

In general , images used for official documents, such as 
20 corroborating photographs, need to have originality 
sufficiently ensured. Since digital images can be altered 
relatively easily without any strange appearance, however, 
the digital images have insufficient admissibility of 
evidence in some cases. Therefore, technologies for 

25 ensuring the originality of digital images and for detecting 
unauthorized alteration of digital images are demanded. As 
a method for achieving these objects, electronic signatures 
which use a hash function have been conventionally examined, 
but electronic signatures are not intended to detect a 
30 position where unauthorized alteration was made. 

As a method for detecting a position where unauthorized 
alteration was made, electronic watermarking has attracted 
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attention conventionally. Electronic watermarking is 

Classified according to characteristics into two types, 
"robust" and "fragile". Robust electronic watermarking is 
robust against attacks and is mainly used for copyright 
5 protection. To detect a position where unauthorized 
alteration was made, fragile electronic watermarking is used. 
Fragile electronic watermarking is very sensitive to image 
processing. During a process to detect unauthorized 

alteration, an electronic watermark which has been changed 
10 somehow can be identified to determine a position where an 
unauthorized alteration was made. Several references are 
listed below. 

Japanese Unexeunined Patent Application Publication No. 
2002-44429 

15 - Japanese Unexamined Patent Application Publication No. 
2002-201703 

Hideakl Tamori, Naoshi Aoki, and Tsuyoshi Yamamoto, 
"Electronic Watermarking Technique Capable of Detecting 
Unauthorized Alteration, Using Number Theoretic Transform," 

20 Technical Research Report of the Institute of Electronics, 
Information and Communication Engineers, IE2001-33, pp. 105- 
110, July, 2001 

Hideaki Tamori, Naoshi Aoki, and Tsuyoshi Yamamoto, 
"Unauthorized-Alteration-Position Detection and 

25 Unauthorized-Alteration Correction in Still Images, Using 
Fragile Electronic Watermarking with Number Theoretic 
Transform, " Technical Research Report of the Institute of 
Electronics , Information and Communication Engineers , 
IE2002-45, pp. 19-24, July, 2002 

30 - H. Tamori, N. Aoki, and T. Yamamoto, "A Fragile Digital 
Watermarking Technique by Number Theoretic Transform," lEICE 
Trans. Fund£unentals , Aug., 2002 
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Disclosure of Invention 

In conventional fragile watermarking methods Intended 
5 to detect a position where unauthorized alteration was made, 
as described above, a hash value or a parity value obtained 
from digital contents is embedded in a bit plane in usual 
cases. These methods, however, have a security problem in 
some cases when their algorithms are disclosed. Specific 

10 unauthorized alteration cannot be detected, for example, in 
a case in which a plurality of different embedding- applied 
Images are synthesized to generate an image altered in an 
unauthorized manner. 

In robust electronic watermarking, there have been 

15 proposed many methods having relatively high security levels, 
which use orthogonal transform such as discrete Fourier 
transform. It is thought that, when such robust electronic 
watermarking methods are applied to fragile electronic 
watermarking, it is expected that security will be further 

20 Improved. Therefore, the inventors have examined a fragile 
electronic watermarking method which uses an orthogonal 
transform called number theoretic transform (NTT) . The 
number theoretic transform has a fragile characteristic in 
which, even if a slight change is applied to a sequence, a 

25 transform result shows a large difference from when the 
sequence is transformed before the slight change is applied. 

In view of the foregoing points, an object of the 
present invention is to propose an unauthorized-alteration 
detecting method, an unauthorized-alteration detecting 

30 program, and a recording medium having recorded the program, 
which use a fragile electronic watermarking method employing 
the number theoretic transform, to which a robust electronic 



watermarking method employing an orthogonal transform has 
been applied. Another object of the present invention is to 
provide an unauthorized- alteration detecting method and 
others capable of easily and visually checking whether 
5 unauthorized alteration was made and the position thereof. 

In conventional electronic watermarking methods 
employing the number theoretic transform, signature 
information is embedded by replacing a relatively small 
range of two lowest order bits or so in the image bits of 

10 the original image. In contrast, an object of the present 
invention is to further enhance security by embedding 
signature information by using all or a desired large range 
of pixel bits of the original image. In the conventional 
methods employing the number theoretic transform, signature 

15 information is embedded by multiplying (convoluting) into a 
number theoretic transform domain. In contrast, an object 
of the present invention is to increase a calculation speed 
by embedding signature information by additions . 

A first solving means of the present invention provides 

20 an unauthorized-alteration detecting method including the 
following steps and a recording medium having recorded an 
unauthorized- alteration detecting program for making a 
computer execute each of the following steps, the following 
steps including: 

25 a step in which a processing section specifies a 

modulus P, an order N, and a root a, which are parameters of 
number theoretic transform; 

a step in which the processing section reads from a 
storage section an original -image block fi,3(x, y) obtained 
30 by block- dividing an original image [f] to which embedding 
is to be applied; 

a step in which the processing section uses the modulus 



P, the order N, and the root a specified, to apply the 
number theoretic transform to the original -Image block fi,j(x, 
y) to calculate the number-theoretic-transformed block Fi,-j(x, 
y) of the original -Image block; 
5 a step In which the processing section determines an 

embedding position (x' , y* ) of a signature Image in each 
block according to a predetermined randomizing function; 

a step in which the processing section reads from the 
storage section a pixel value gi,^ of the signature image to 

10 be embedded; 

a step in which the processing section obtains an 
embedding eunount 8 in each block from the number- theoretic- 
transformed block Fi,-j(x*, y') of the original -image block at 
the embedding position, the pixel value gi.j of the signature 

15 image, and embedding strength e; 

a step in which the processing section adds or 
subtracts the embedding amount 8 to or from the number- 
theoretic- transformed block Fi,j(x, y) of the original -image 
block, based on (x, y) to obtain the number- theoretic- 

20 transformed block Hi,-|(x, y) of an embedding -applied -image 
block; 

a step in which the processing section applies inverse 
number theoretic transform to the number- theoretic - 
transformed block Hi,j(x, y) to obtain the embedding -applied- 

25 image block hi,j(x, y); and 

a step in which the processing section obtains the 
embedding -applied- image block hi,j(x, y) for each of all (1, 
j) blocks or a desired range of (i, j) blocks to obtain an 
embedding -applied image [h] , and stores it in the storage 

30 section and/or outputs it from an output section or an 
interface. 

A second solving means of the present Invention 
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provides an unauthorized-alteration detecting method 
including the following steps and a recording medium having 
recorded an unauthorized-alteration detecting program for 
making a computer execute each of the following steps, the 
5 following steps including: 

a step in which a processing section reads from a 
storage section, an input section, or an interface an 
embedding -applied -image block hi,j(x, y) obtained by block- 
dividing an embedding -applied image [h] ; 

10 a step in which the processing section specifies a 

modulus P, an order N, and a root a, which are parameters of 
number theoretic transform; 

a step in which the processing section applies the 
number theoretic transform to the embedding -applied- image 

15 block hi,3(x, y) to calculate the number- theoretic- 
transformed block Hi,3(x, y) of the embedding -applied- image 
block; 

a step in which the processing section determines an 
extraction position (x", y' ) corresponding to an embedding 
20 position of a signature image according to a predetermined 
randomizing function; 

a step in which the processing section obtains a 
remainder by dividing the number- theoretic -transformed block 
Hi,j(x', y' ) at the extraction position by embedding strength 
25 e to extract a pixel value gi.^j of the signature image; and 

a step in which the processing section obtains the 
pixel value gi,^ of the signature image in each of all (i, J) 
blocks or a desired range of (i, j) blocks to obtain the 
signature image [g] , and stores it in the storage section 
30 and/or outputs it from a display section, an output section, 
or an interface. 

A third solving means of the present invention provides 
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an unauthorized-alteration detecting method including the 
following steps and a recording medium having recorded an 
unauthorized- alteration detecting program for making a 
computer execute each of the following steps, which include 
5 an unauthorized-alteration detecting method comprising an 
embedding process for embedding a signature image into an 
original image and an extraction process for extracting the 
signature image, 

wherein the embedding process comprises: 

10 a step in which a processing section specifies a 

modulus P, an order N, and a root a, which are parameters of 
number theoretic transform; 

a step in which the processing section reads from a 
storage section an original -image block fi,j(x, y) obtained 

15 by block- dividing an original image [f] to which embedding 
is to be applied; 

a step in which the processing section uses the modulus 
P, the order N, and the root a specified, to apply the 
number theoretic transform to the original -image block fi,j(x, 

20 y) to calculate the number-theoretic-transformed block Fi,j(x, 
y) of the original -image block; 

a step in which the processing section determines an 
embedding position (x" , y' ) of a signature image in each 
block according to a predetermined randomizing function; 

25 a step in which the processing section reads from the 

storage section a pixel value gi^j of the signature image to 
be embedded; 

a step in which the processing section obtains an 
embedding amount 6 in each block from the number- theoretic- 
30 transformed block Fi,j(x' , y' ) of the original -image block at 
the embedding position, the pixel value gi,-j of the signature 
image, and embedding strength 8; 
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a step in which the processing section adds or 

I t 

subtracts the embedding amount 6 to or from the number- 
theoretic- transformed block Fi,j(x, y) of the original -image 
block, based on (x, y) to obtain the number -theoretic - 
5 transformed block Hi.j(x. y) of an embedding- applied- image 
block; 

a step in which the processing section applies inverse 
number theoretic transform to the number-theoretic- 
transformed block Hi.j{x, y) to obtain the embedding- applied- 

10 image block hi,j(x, y) ; and 

a step in which the processing section obtains the 
embedding- applied- image block hi,j(x, y) for each of all (i, 
3) blocks or a desired range of (i, j) blocks to obtain an 
embedding -applied image Ih] , and stores it in the storage 

15 section and/or • outputs it from an output section or an 
interface, 
and 

the extraction process comprises: 

a step in which the processing section reads from the 
20 storage section, the input section, or the interface an 
embedding- applied- image block hi,-j(x, y) obtained by block- 
dividing an embedding- applied image [h] ; 

a step in which the processing section specifies a 
modulus P, an order N, and a root a, which are parameters of 
25 number theoretic transform; 

a step in which the processing section applies the 
number theoretic transform to the embedding -applied -image 
block hi,j(x, y) to calculate the number -theoretic- 
transformed block Hi,j(x, y) of the embedding-applied-image 
30 block; 

a step in which the processing section determines an 
extraction position (x" , y' ) corresponding to an embedding 
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position of a signature i^age according to a predetermined 
randomizing function; 

a step in which the processing section obtains a 
remainder by dividing the number- theoretic- transformed block 
5 Hi,-,(x', y') at the extraction position by embedding strength 
e to extract a pixel value gi,j of the signature image; and 

a step in which the processing section obtains the 
pixel value g±^^ of the signature image in each of all (i, j) 
blocks or a desired range of (i, j) blocks to obtain the 
10 signature image [g], and stores it in the storage section 
and/or outputs it from a display section, the output section, 
or the interface. 



Brief Description of the Drawings 
15 Fig. 1 is an explanatory view of y* (mod 13) of a prime 

number 13. 

Fig. 2 is an outline view of a system configuration. 
Fig. 3 is a structural view of an unauthorized- 
alteration-position detecting apparatus. 
20 Fig. 4 is an explanatory view of electronic 

watermarking which employs discrete Fourier transform. 

Fig. 5 is an explanatory view of fragile electronic 
watermarking which employs number theoretic transform. 
Fig. 6 is a flowchart (1) of an embedding process. 
25 Fig. 7 is a flowchart (2) of the embedding process. 

Fig. 8 is an explanatory view of how embedding affects 
pixel values . 

Fig. 9 is a flowchart of an extraction process. 
Fig. 10 is a view showing images used for experiments. 
30 Fig. 11 is an image view (1) showing an experimental 

result . 

Fig. 12 shows the relationship between the quality of 
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an output Image and embedding strength e. 

Fig. 13 is an image view (2) showing an experimental 
result . 

5 Description of the Preferred Embodiments 
1. Niomber theoretic transform 
1 . 1 Outline 

10 The number theoretic transform will be first described. 

If necessary, refer to the following references for the 
niimber theoretic transform. 

J. H. McClellan and C. M. Rader, "Number Theory in 
Digital Signal Processing," Prentice-Hall, New Jersey, 1979. 
15 - "Handbook of Digital Signal Processing," edited by the 
Institute of Electronics, Information and Communication 
Engineers, published by Ohmsha, Ltd., Tokyo, 1993. 

"Mathematical Basics of Encryption," written by S. C. 
Coutinho and translated by Hing Lin, Springer-Verlag Tokyo 
20 Ltd., Tokyo, 2001. 

"Fast Fourier Transform Algorithm," written by H. J. 
Nussbaumer and translated by Masahiko Sagawa and Hitoshi 
Homma, Science Press, Inc., Tokyo, 1989. 

Takatsugu Taniogi, "Algorithm and Parallel Processing," 
25 Digital Signal Processing Library No. 4, Corona Publishing 
Co. Ltd., Tokyo, 2000. 

Yoshinao Aoki, "Wave Signal Processing," Morikita Shuppan 
Co., Ltd., Tokyo, 1986. 

It is assumed that parameters P and a are positive 
30 integers and a parameter N is the minimum positive integer 
which satisfies a** = 1 (mod P). When <|)(P) indicates an Euler 
function, a which satisfies N = <|)(P) is called a primitive 
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root of an order apd a ,which satisfies N < <|)(P) is called 
a root of the order N. (()(P) expresses the number of 

integers smaller than P and mutually prime with respect to P. 

The following transform pair which uses a will be 
5 examined . 

N-1 

X{k) = x{n)a^^ (mod P) (1) 

Tl=0 

^(") = £ ^ (modP) (2) 

fc=0 

Since the foregoing calculations can be performed in 
the remainder system with respect to a modulus of P, an 
round-off error does not occur at all. In an application to 

10 electronic watermarking, if P is made confidential, since a 
third party cannot obtain an expected transform result due 
to the characteristic of the number theoretic transform, P 
can be used as key information. In the number theoretic 
transform, a Mersenne number or a Fermat number is typically 

15 used as P (for example, refer to "Handbook of Digital Signal 
Processing," edited by the Institute of Electronics, 
Information and Communication Engineers, published by Ohmsha, 
Ltd., Tokyo, 1993 and others). There is, however, a severe 
limitation. The number of numbers which can be selected is 

20 small, and using as the key information is inappropriate in 
some cases. Therefore, a technique is applied in which P 
can be any compound number generated by a power of a prime 
number . 

It is assumed that P is expressed by the following 
25 expression with p being a prime number. 
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p = p?p?.--p^r;r (3) 

The order N is first selected among positive integers 
satisfying the following expression. 

iV|GCD[(pi - 1), (p2 - 1), . . . , (p„ - 1)] (4) 

5 A root ai.ro of the order N modulo Pm is calculated, and then, 
a root a2,in of the order N is obtained by the following 
expression. 

a2.m = a^|^ ' (modp^T) (5) 

Then, a root a of the order N modulo P can be obtained from 
10 a2,m by the Chinese remainder theorem (for example, refer to 
"Fast Fourier Transform Algorithm^" written by H. J. 
Nussbaumer and translated by Masahiko Sagawa and Hitoshi 
Homma, Science Press, Inc., Tokyo, 1989, and others.) 

Generally, to extend the range of numbers which can be 
15 handled in calculations in a remainder system, sets of 
remainder systems having different moduli are used and 
calculation results are obtained in units of sets having the 
moduli in some cases. The Chinese remainder theorem is to 
obtain a unique number in a certain system of notation from 
20 the sets and can be expressed in the following way (refer to 
Yoshinao Aoki, "Wave Signal Processing," Morikita Shuppan 
Co., Ltd., April 3, 1986). 

[Theorem! Assuming that moduli mi (i = 1, 2, , 1) are 

25 positive integers prime to each other and M ~ mim2 ... mi , a 
positive integer "a" (0 < a ss (M - 1)) which satisfies the 
following expression 
<a>n,i = ri (i = 1, 2, 1) 
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(where ri are remainders of "a" with respect to the moduli 
mi) 

is uniquely given by the following expression, 
a = Sdidi'^ri (mod M) 

where, 2 is the sum for i = 1 to 1, di = M/mi, and di'^ = 
(<di>mi)*^ (mod mi) ((<di>nii)"^ are multiplication inverses at 
moduli mi) • 

1 . 2 Examples 

For example, number theoretic transform with P = 61009 
= 13^ X 19^ will be examined. Since GCD[12, 181 = 6, N is 
selected from N|6=[l, 2, 3, 6]. N = 3is employed here . 
Next, roots of an order 3 with respect to moduli 13 and 19 
are calculated. When they are called ai,i and ai,2* = 3 

and ai,2 = 7. Therefore, when roots of an order 3 with 
respect to moduli 13^ and 19^ are called aa.i and 0.2.2 b they 
are calculated as follows. 

a 2.1 = 3"'"' = 146 (mod 13^) 
a 2.2 = 7*^*"* = 292 (mod 19^) 

Then, according to the Chinese remainder theorem, which 
is well known, a root a of an order 3 with respect to a 
modulus 61009 is obtained as a 653. 

Fig. 1 shows an explanatory view of y* (mod 13) of a 
prime 13. 

For example, how to find a rood of an order 3 with 
respect to a modulus 13 will be examined. Vertically 
indicated is "y" and horizontally indicated is "x" . When 
"1" appears at an interval of N, "y" is an order N (3 in 
this case) with respect to a modulus 13. Since "3" appears 
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at an interval of thi^ee w^en y is 3 or 9, the roots are 3 
and 9. If the minimiim niomber is selected cunong a plurality 
of roots, for example, the root is 3. For general issues of 
the number theoretic transform, refer to the following 
5 website or others. 

http : / /f ox . zero . ad . jp/-zat25960/math/number /index . htm 

According to the foregoing description, an example case 
in which the number theoretic transform is applied to a 
sequence x = [10, 20, 30]^ at N = 3 will be examined. 
10 Expressions (1) and (2) can be expressed in the following 
way in matrix notation. 



X = [T]x 
X = [T]"^X 
where , 

15 X = [X(0), X(l), X(2)]'' 
X = [x(0), x(l), x(2)]'' 

A transformation matrix [T] is expressed below. 



1 



1 



1 

653^ 
653* 



[T] = [a*"] = 



1 653 
1 653^ 



1 



1 



1 



1 



653 



60355 



(mod 61009) 



1 60355 



653 



An inverse transformation matrix [T]"^ is expressed below. 
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1 










1 


1 


1 
1 


= 3 


-1 


1 


653 ^ 








1 


653-^ 


DDO 




' 40673 


40673 


40673 




40673 


60791 


20554 




40673 


20554 


60791 



(mod 61009) 



When the number theoretic transform is applied to the 
following is obtained. 





1 


1 


1 




10 ' 


X = 


1 


653 


60355 




20 




1 


60355 


653 




30 



= [60, 54459, 6520]^ (mod 61009) 

vnien the inverse transform is applied to X by using [T]'^, 

the following is obtained. 

X = [T]-^X = [10, 20, 30]*^ (mod 61009) 

It is assumed here, for excimple, that the transformed 



sequence . X = [60, 54459, 6520 1'^ is altered in 



an 



10 unauthorized manner to X' = [61, 54459, 6521]'. The output 
x' of inverse transform is shown below, which is very- 
different from "x" . 

X' = [T]-^X' = [11, 238, 40485]"^ (mod 61009) 

This result is obtained from a characteristic of the number 
15 theoretic transform, no round-off error, and it is effective 
to detect unauthorized alteration. 



2 • Hardware 



20 Fig. 2 shows an outline view of a system configuration. 

This system includes a transmitter computer 10, a receiver 
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computer 20, and an authentication-organization computer 30. 
The transmitter computer 10 sends image information [h] in 
which signature information has been embedded by electronic 
watermarking to the receiver computer 20. Signature data 
5 [g] is determined in advance between the transmitter 
computer 10 and the receiver computer 20. The transmitter 
computer 10 sends key information P and further, if 
necessary, an order N to the authentication -organization 
computer 30. The receiver computer 20 obtains the key 

10 information P and further, if necessairy, N from the 
authentication-organization computer 30. 

A system other than that described above may be 
configured such that the authentication-organization 
computer 30 is omitted, and [h] , P, and further, if 

15 necessary, N are directly transferred between the 
transmitter computer 10 and the receiver transmitter 20. 

The following means may be, for excunple, used as 
transfer means for transmitting [h] , P, and N from the 
transmitter to the receiver. Since [h] may be made public, 

20 the transmitter computer 10 may directly transmit [h] to the 
receiver computer 20 by e-mail. However, because the key 
information P is a secret key, it is better in terms of 
security that the key information is encrypted by RSA or 
other methods and then transmitted from the transmitter 

25 computer 10 to the receiver computer 20 or to the 
authentication-organization computer 30. When this system 
is used in a digital camera, for example, one possibility is 
that the digital camera directly transmits the key 
information to the authentication organization. In this 

30 case, without using e-mail, an encrypted file can be 
directly transmitted by packet switching or circuit 
switching. The above description also applies to a case in 
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which the transmitter computer 10 receives the key 
Information from the receiver computer 20 or from the 
authentication-organization computer 30. 

Fig. 3 . Is a structural view of an unauthorized- 
5 alteration-position detecting apparatus. 

The apparatus Includes a processing section 1, which Is 
a central processing unit (CPU), an Input section 2, an 
output section 3, a display section 4, a storage section 5, 
and an interface 6. The processing section 1, the input 

10 section 2, the output section 3, the display section 4, and 
the storage section 5 are connected by appropriate 
connection means, such as a star connection or a bus 
connection. The storage section 5 has a key file 51 for 
storing parameters used in the number theoretic transform, 

15 an original -image file 52 for storing an original image [f ] , 
a signature -image file 53 for storing a signature -image file 
[gl* and an embedding- applied- image file 54 for storing an 
embedding -applied- Image file [h] . The storage section 
further stores in advance randomizing functions rx* and ry. 

20 and embedding strength e, described later. The Interface 6 
is connected to various networks such as the Internet and a 
mobile communication network, and transmits and receives 
Information to and from other computers by radio or by wire. 

25 3. Unauthorized-alteration-position detection 

3.1 Robust electronic watermarking method using orthogonal 
transform 

For reference, an electronic watermarking method using 
30 discrete Fourier transform will be described first. 

Fig. 4 is an explanatory view showing an example 
electronic watermarking method using discrete Fourier 
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transform. Fig. 4(a) shows an embedding process and Fig. 
4(b) shows an extraction ^process. 

In robust electronic watermarking, many techniques have 
been reported which embed signature information in a 
spatial -frequency domain obtained by orthogonal transform. 
As an example of such electronic watermarking methods, a 
technique which uses discrete Fourier transform, as shown in 
the figure, will be described below. 

In the embedding process, the processing section 1 
first divides an original image [f] (KN x LN pixels, 8-bit 
gradations) into blocks each having N by N pixels. Each of 
the obtained blocks is called fi^j(x, y) , where i and j 
indicate the position of the block in the image, and x and y 
indicate the coordinates of a pixel in the block (i = 0, 
1, K-1, j = 0, 1, L-1, X and y « 0, 1, N-1). 

Then, the processing section 1 applies two-dimensional 
Fourier transform to fi,3(x, y), and the transform result is 
expressed as Fi,3(x, y) . 

The processing section 1 prepares a signature image [g] 
(K by L pixels, 1-bit gradation) by reading it from the 
storage section 5 or by other means . Each pixel value of 
[g] is called gi,j (= 0 or 1), and i and j indicate the 
coordinate of a pixel in [g] , and correspond to i and j in 
fi,j(x, y) . The processing section 1 adds gi,-, to a low- 
frequency component of Fi,3(x, y) to obtain the Fourier 
transformed block Hi.j(x, y) of an embedding -applied block. 
More specifically, when e indicates embedding strength and 
(x', y') indicates the coordinate of an element to be 
embedded, the following expression is obtained. 



- 19 - 



15 



25 




, . = ^ y) + ^9i,i x = x',y = y' 

y) otherwise 

(6) 



When the user specifies e and (x' , y') uniquely In 
advance In common to the embedding process and the 
5 extraction process, these factors are keys to extract the 
embedded Image. Then, the processing section 1 applies 
Inverse Fourier transform to Hi,j(x, y) to obtain an 
embedding -applied block hi,j(x, y) . The processing section 1 
applies the foregoing operations to all blocks to obtain an 
10 embedding- applied Image [h] . 

The processing section 1 obtains the difference between 
Hi.3(x', y') and Fi,j(x' , y* ) to Implement the extraction 
process for the signature Information. In other words, gi^j 
Is obtained by the following expression. 



In techniques such as that described above, since 
signature Information Is embedded In a low-frequency 
component, the signature Information Is not susceptible to 
20 be broken by attacks such as minor Image processing, and the 
techniques are robust. For this reason, many techniques 
which use a spatial frequency domain obtained by orthogonal 
transform are used In robust electronic watermarking 
Intended to protect copyrights. 



3.2 Fragile electronic watermarking method using number 
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theoretic transform 

Fig. 5 is an explanatory view showing a fragile 
electronic watermarking method using the number theoretic 
transform. Fig. 5(a) shows an embedding process and Fig. 
5 5(b) shows an extraction process. 

Although the number theoretic transform is the same 
type of orthogonal transform as the discrete Fourier 
transform, since the transform domain does not have any 
physical meaning unlike the frequency domain, the above 

10 description in "3.1 Robust electronic watermarking method 
using orthogonal transform" cannot be applied as it is. In 
addition, the technique described in 3.1 needs the original 
image to extract the signature information, it may be 
impractical for the purpose of detecting an unauthorized- 

15 alteration position. With these issues taken into account, 
a technique shown in the figure will be proposed here . 

3.2.1 Embedding process 

Fig. 6 and Fig. 7 shows flowcharts (1) and (2) of the 
20 embedding process. 

When the embedding process is started, the processing 
section 1 specifies a modulus P, an order N, and a root a, 
which are parameters of the number theoretic transform 
(SlOl) . 

25 P is stored in advance in the key file 51 before the 

process, for example, by the user with the use of the input 
section 2 or by the processing section 1 by determining a 
random value with the use of thermal noise or others. The 
processing section 1 refers to the key file 51 to specify P. 

30 P can be any compound number generated by powers of prime 
numbers as shown in expression (3). To handle all integers 
which pixel values can be, in remainder calculations, the 
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processing section J selects an Integer larger than the 
maximuun number of pixel values, as an example. 

After P is determined, the processing section 1 selects 
N according to expression (4). The processing section 1 
5 refers to the key file 51 or performs a calculation by the 
use of expression (4) or others to specify N. N may be 
stored in advance in the key file 51 by the input section 2. 
Alternatively, the processing section 1 may obtain a 
candidate depending on P by expression (4), and if there are 

10 a plurality of candidates, the processing section 1 may 
select one of them. Since N indicates a block size, if it 
is very large, a correct position cannot be detected in some 
case. As an example, N is appropriately set to 2 or 4 . The 
user can select any number or the system can determine in 

15 advance an appropriate selection method. 

When P and N are determined, the processing section 1 
calculates the root a by expression (5), the Chinese 
remainder theorem, and others to obtain the root a uniquely. 
As long as P and N are unknown, the extraction process, 

20 described later, cannot be performed. Therefore, P or both 
P and N are keys for detecting unauthorized alteration. 

Next, the processing section 1 reads an original -image 
block fi,j(x, y) to which embedding is to be applied, which 
are obtained by dividing an original image [f] into blocks, 

25 from the original -image file 52 of the storage section 5 
(S103). In the same way as described above, the original 
image [f] (KN x LN pixels) is divided into K by L blocks 
each having N by N pixels. Each of the obtained blocks is 
called fi,j(x, y) , where i and 3 indicate the position of the 

30 block in the image, and x and y indicate the coordinates of 
a pixel in the block (1=0, 1, K-1, j = 0, 1, L-1, 

X and y=0, 1, , N-1). 
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Then, the proqesslng section 1 calculates a two- 
dimensional Fourier transformed, original -image block F±,j(x, 
y) of the original -image block fi.j(x, y) by the use of P, N, 

and a specified in step SlOl according to expressions (1) 
5 and (2) (S105) . 

Next, the processing section 1 obtains the number- 
theoretic- transformed block Hi,j(x, y) of an embedding- 
applied image block by using the following expression in a 
way described in details below. 



where, 6 is an integer satisfying expression (9) and having 
the minimum absolute value. 



The user can select any embedding strength e in this case. 

15 When signature information has one bit, for exsunple, the 
strength needs to be an integer equal to 2 or larger. It is 
preferred with the deterioration of the embedding- applied 
image taken into account that a small value be used. Since 
the transform domain does not have any physical meaning in 

20 the number theoretic transform, (x* , y' ) are determined by 
the following random functions. 

The processing section 1 first refers to the 
randomizing functions r^* and ry. in the storage section 5 to 
determine an embedding position (x' , y' ) random in each 

25 block (S107). The randomizing functions r^- and ry. can 
determine an embedding position (x" , y" ) uniquely, and can 
be specified, for exeimple, as follows. 



10 
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x'-r^/(P,i,i,/,;z(0,0)) 
y' = ry(P, 2, J, (0,0)) 
I = j — 1 (mod L) 



(10) 

(11) 

(12) 



In this case, the randomizing functions Include an original- 
Image block fi,i(0, 0) to enhance security. Details thereof 
will be described In 5.(7). An (0, 0) element of the left 
adjacent block Is fi,i(0, 0). In the embedding process, 
since the (0, 0) element Is not changed. If the same r^' and 
ry. are also specified In the extraction process, the same 
values can be obtained from the randomizing functions. 
Instead of the element In the left adjacent block, an 
element In the right adjacent block or a predetermined block 
may be used. An appropriate element which Is not changed 
may also be used. 

The processing section 1 also reads the pixel value gi,j 
of a signature Image to be embedded, from the signature - 
Image file 53 of the storage section 5 (S109). Step S107 
and step S109 are executed In parallel. Step S109 may be 
executed after step S107 Is executed. Alternatively, step 
S107 may be executed after step S109 Is executed. 

Next, the processing section 1 calculates 6 (Sill) by 
using the obtained Fi,j(x' , y' ) and gi^j according to 
expression (9), described above. The processing section 1 
calculates the number -theoretic -trans formed block Hi.j(x, y) 
of the embedding -applied image block by using the n\imber- 
theoretlc- transformed block Fi,j(x, y) of the original -image 
block and 8 obtained in step Sill, according to expression 
(8) (S113). Then, the processing section 1 calculates the 
inverse-number- theoretic- transformed embedded image block 
lii.j(x, y) of Hi,j(x, y) by using expressions (1) and (2), 
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described above. 

Fig. 8 is an explanatoiry view showing how embedding 
affects pixel values. 

More specifically, when the inverse transformed 
5 sequence of Hi^^Cx, y) is called hi.^Cx, y) , the following 
expression is satisfied due to a characteristic of the 
number theoretic transform as shown in the figure. 



If N is an odd number, this relationship is not satisfied. 

10 Therefore, in the present embodiment, N needs to be an even 
number equal to 2 or larger. 

The processing section 1 stores the obtained embedding- 
applied image block hi,-j(x, y) at an appropriate area (work 
area or others) in the storage section 5 (S117). When steps 

15 SlOl to S117, described above, have been executed for all 
blocks (or blocks in a desired area), the processing section 
1 proceeds to step S121. If not (S119), the processing 
section 1 returns to step S103, and subsequent steps are 
repeated. The processing section 1 executes the above - 

20 described steps for all the blocks (or the blocks in the 
desired area) to obtain an embedding -applied image [h] . The 
processing section 1 saves the number- theoretic -transform 
parameter P and the embedding -applied image [h] into the 
embedding -applied image file 54 (S121). The processing 

25 section 1 transmits the parameter P and the embedding- 
applied image [h] to the receiving- side apparatus through 
the interface 6 or the output section 3 (S123). The 
processing section 1 may transmit N as a parameter, if 
necessary. Step S121 and step S123 are executed in parallel 
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In this case. Step 5123 may be executed after step S121 is 
executed. Alternatively, step S121 may be executed after 
step S123 is executed. The processing section 1 may also 
transmit the modulus P and^ if necessary, the order N to the 
5 authentication-organization apparatus ( authentication- 
organization computer 30). 

3.2.2 Extraction process 

Fig. 9 is a flowchart of the extraction process. 

10 When the extraction process is started, the processing 

section 1 receives the number- theoretic- transform parameter 
P and the embedding -applied image [h] from the transmission- 
side apparatus, and stores them in the embedding -applied- 
image file 54. The processing section 1 may further receive 

15 N from the transmission- side apparatus according to 
circumstances. The processing section 1 may receive the 
modulus P, which is a number- theoretic- transform parameter, 
and, if necessary, N from the authentication-organization 
apparatus. When [h] is stored in advance in the embedding- 

20 applied-image file 54, step S201 can be omitted. The 
processing section 1 refers to the embedding -applied -image 
file 54 to read an embedding- applied- image block hi.j(x, y) 
(S203), which is obtained by block- dividing the embedding- 
applied image [h] . 

25 Then, the processing section 1 specifies number- 

theoretic- transform parameters P, N, and a (S204) in the 
same way as in step SlOl, described above. The processing 
section 1 uses the specified parameters to calculate the 
number- theoretic -transformed block Hi,j(x, y) of the 

30 embedding -applied image block hi,j(x, y) according to 
expressions (1) and (2) (S205). The processing section 1 
also uses the randomizing functions rx- and ry. stored in 
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advance in the stor<age section 5 to determine (S207) a 
signature -Image extraction position (x' , y' ) corresponding 
to tlie position where the signature Image, described before, 
has been embedded. 
5 Next, the processing section 1 extracts a pixel value 

gi.j of the signature Image from the number-theoretic- 
transformed block Hi,j(x', y') of the embedding -applied Image 
block at the extraction position (S209). More specifically, 
the processing section 1 obtains a remainder when Hi,j(x' , 
10 y') Is divided by e as In the following expression to obtain 
the pixel value of the signature Image. Expression (9) can 
be changed to expression (14), and thereby the pixel value 
gi.j of the signature Image can be extracted. 

9id = Hij{x\y) (mod e) (14) 

15 The processing section 1 stores the pixel value gi,^ of 

the signature Image at an appropriate area (work area or 
others) In the storage section 5 (S211). VThen processing 
steps S201 to S211 have already been applied to all blocks 
(or a predetermined range of blocks), the processing section 

20 1 proceeds to step S215. If not (S213), the processing 
section 1 returns to step S203 and the above -de scribed 
processing Is repeated. The processing section 1 extracts 
gi,j from all the blocks (or the predetermined range of 
blocks) to obtain the signature Image [g]. The processing 

25 section 1 saves the signature Image [g] In the signature- 
Image file 53 of the storage section 5, and displays It on 
the display section 4 or outputs It from the output section 
3 or the Interface 6 (S215). The processing section 1 may 
also obtain an original Image [f] based on the embeddlng- 

30 applied Image [h] and the signature Image [g] to store 
and/or output and display It, If necessary. 
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When P and N are correct and the embedding- applied 
Image [h] Is not dlterdd In an unauthorized manner, the 
correct signature Image Is taken out. If P and N are 
Incorrect, or [h] has been altered In an unauthorized manner, 
5 Hi,j(x, y) obtained when unauthorized alteration was made Is 
leirgely different from the correct value due to a 
characteristic of the number theoretic transform • Therefore, 
It Is highly possible that the signature Information 
extracted therefrom Is Incorrect. Consequently, whether 
10 unauthorized alteration was made and the position thereof 
can be visually determined from the signature Image formed 
of the extracted signature Information. 

4. Experimental results 

15 

Fig. 10 Is a view showing Images used for experiments. 
Fig. 10(a) shows the current Image and Fig. 10(B) shows a 
signature Image. The present Invention was applied to text 
(256 by 256 pixels, 8-blt gradations), which Is a standard 

20 Image of SIDBA, such as that shown Fig. 10(a), and 
effectiveness was examined. As number-theoretic-transform 
parameters serving as keys, P = 85,147,693 and N = 4 were 
used, and the signature Image shown In Fig. 10(b) (64 by 64 
pixels, 1-blt gradation) was used. Embedding strength e was 

25 set to 5. The following functions were used as the 
randomizing functions rx> and ry* as the most simple examples. 

Tx' = lx{P+i+j+fij(0,0)} (modiV) 
Ty' =2x{P+i+j+fij{0,0)} (modiV) 

Fig. 11 shows an Image figure (1) obtained as an 
experimental result. Fig. 11(a) Is an embedding -applied 
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Image and Fig. 11(b) Is ^ an extracted signature Image. An 
embedding process was applied to the image shown in Fig. 
10(a) to obtain the image shown in Fig. 11(a). The SNR is 
56.73 dB, and embedding deterioration was hardly seen. 

Fig. 12 shows the relationship between the quality of 
an output image and the embedding strength e. 

This figure is a graph showing the relationship between 
the SNR of an embedding -applied image and e when the 
embedding processing was executed with e being changed from 
2 to 12. As E increased, the SNR decreased. This is 
because the magnitude of 8 in the embedding process is 
proportional to e. Since the SNR was high for any e, it 
means that deterioration was hardly seen in the images. Fig. 
11(b) shows the signature image extracted from the image 
shown in Fig. 11(a), which was exactly the same was that 
shown in Fig. 10(b). 

Fig. 13 shows an image figure (2) obtained as an 
experimental result. Fig. 13(a) is an example image altered 
in an unauthorized manner and Fig. 13(b) is an image 
extracted from that shown in Fig. 13(a). 

In this case, the image shown in Fig. 11(a) was altered 
in an unauthorized manner to obtain the image shown in Fig. 
13(a). More specifically, a rectangular area which included 
a number "0" was copied and pasted on an area which included 
a number "8" by using photo retouch software. Fig. 13(b) 
shows a signature dLmage extracted from the image shown in 
Fig. 13(a). Since the position where the alteration was 
made in an unauthorized manner matches a portion where the 
signature image was broken, it was understood that the 
position where an alteration is made can be visually 
determined. 
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Security discussions . 



The security of the present Invention obtained when an 
embedding -applied Image Is altered In an unauthorized, memner 
5 will be discussed below. It Is assumed that the attacker 
knows an embedding- applied Image [h] and all algorithms but 
does not know key Information P or N, the original image [f], 
or a signature image [g]. 

10 (1) Analyzing appropriate unauthorized alteration from 
algorithms 

For simplicity, the following discussion will be made for a 
case in which N is set to 2. An original -image block is 
assumed to be as follows with a, b, c, and d being set to 
15 positive Integers. 



This block is changed to the following by the embedding 
process . 



20 Then, the following is obtained by the number theoretic 
transform in the extraction process. 






Correct signature information can be obtained by expression 
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(14). A case In which hi;j(x, y) is altered in unauthorized 
manner as shown below will be examined, with \i2, Ha, and 

M.4 being set to integers. 

+ /X3 d-\- S -\- fJ>4j 

The number theoretic transform is applied to hi.j(x, y) in 
the extraction process, the following are obtained. 

\C -6-{-i/3 D + 6-\-vaJ 

l>'2 = Ml + Ms + a(M2 + /X4) 
i^S = Ml + M2 + Q:(m3 + M4) 
= til + a(/X2 + Ms) + a^M4 

vnien X,l, X2, X,3, and X4 are set to any positive integers, 

1^1 = Ml + M2 + M3 H- M4 = Aie 
1^2 = Ml + Ms H- ck(M2 + M4) = A2e 
1^3 = Ml + M2 + a(M3 + M4) = Aae 
1^4 = Ml + a(M2 + Ms) + a^M4 = A46: 

if there are ni, H2» 1x3, and ^,4 which satisfy the foregoing at 
the same time, unauthorized alteration cannot be detected 
with the present invention. This is because the remainders 
obtained when Vi, V2, V3, and V4 are divided by "e" become 
zero due to unauthorized alteration. In this case, the 
simultaneous equations for H2, M-3, and (14 include a. 

Assuming that the attacker does not know a, it is difficult 
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for the attacker to solve the simultaneous equations 
analytically. * 

(2) Any partial unauthorized alteration 

In the present invention, signature information is 
extracted by the use of the remainder obtained when Hi,j(x' , 
y') is divided by e. This means that correct signature 
information is obtained at a probability of e"^ per block 
even if any unauthorized alteration was made. In general, 
there is almost no meaning due to image redundancy when only 
one block is altered in an unauthorized manner. Therefore, 
the attacker needs to alter a plurality of blocks in an 
unauthorized manner. Vlhen T blocks are altered in an 
unauthorized manner, its success probability is e"*^. When N 
is 2 and e is 5, for example, a probability of successful 
unauthorized alteration of 4 by 4 blocks (8 by 8 pixels) is 
5'^^, which means that unauthorized alteration with this 
method can be detected at a high possibility. As e 
increases, unauthorized alteration becomes difficult, but 
image deterioration also becomes high. Therefore, in the 
present invention, security and image quality are trade-offs 
However, in an experiment, the SNR was 48.2 dB when e was 12 
This means that embedding can be performed such that 
deterioration is visibly hardly seen even when £ is 
relatively large. 

(3) Unauthorized alteration in bit plane 

Since the present invention is not an embedding technique 
based on a bit plane, an attack focusing on it does not have 
any meaning. For exeunple, unauthorized alteration of only 
the LSB affects hi,j(x, y) a little but affects Hi.^Cx, y) 
much due to a characteristic of the number theoretic 
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transform. Therefore, It is highly possible that obtained 
signature information is unauthorized one. 

(4) Exhaustive search for key 

5 Since P can be any compound nximber generated by powers 

of prime numbers, exhaustive search for the key P can be 
performed by a computer with a search range of integers. 
Whether P is correct is determined by a person by visually 
checking whether an extracted signature image is meaningful. 
10 It is thought that this job takes much time. Therefore, it 
is practically difficult to perform exhaustive search for 
the key. 

(5) Geometric change such as enlargement, reduction, and 
rotation 

If the resolution or the shape is changed, since rx* and 
ry. or N cannot correspond to such changes, the change is 
detected as unauthorized alteration in the entire image in 
the present invention. 

(6) Cut and paste within an image 

Unauthorized alteration will be examined in which [h] is 
divided into blocks, and the positions of blocks are 
exchanged, or a block is copied and pasted at any position. 
The unauthorized alteration in the above -described 
experiment is of this type. In this case, since r^* and ry. 
are functions which include i and j in the present invention, 
rjt« .or ry- cannot correctly correspond in blocks whose 
positions were changed, in this type of unauthorized 
alteration. Therefore, unauthorized alteration of this type 
can be detected at a high possibility. 
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(7) Cut and paste between a plurality of different images 
to which embedding has been applied 

For example, a case will be examined in which each of a 
plurality of different embedding -applied images is divided 
5 into blocks, and blocks located at the same position are 
exchanged to generate one image. It is assumed here that 
all the images have the Scune resolution and the same P, N, 
and [g] are used in their embedding processes. In this case, 
since r^' and ry- are generated as functions which include 
10 the pixel value fi.i(0, 0) in the left adjacent block in the 
present invention, r^* or ry. cannot correctly correspond. 
Therefore, unauthorized alteration of this type can be 
detected at a high possibility. 

15 6 . Conclus ion 

In the present invention, unauthorized-alteration- 
position detection which uses fragile electronic 
watermarking employing the number theoretic transform has 

20 been proposed as an application of robust electronic 
watermarking employing a conventional orthogonal transform. 
The effectiveness of the proposed method was exeunined in the 
experiments, and the successful results were obtained. In 
addition, security of the proposed method has also been 

25 examined against various attacks. 

An unauthorized-alteration detecting method or an 
unauthorized-alteration detecting apparatus and system 
according to the present invention can be provided by an 
unauthorized- alteration detecting program for making a 

30 computer execute each step thereof, a computer- readable 
recording medium having recorded the unauthorized-alteration 
detecting program, a program product which includes the 
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unauthorized-alteration detecting program and which can be 
loaded into an internal memory of a computer, a computer 
which includes the program, such as a seirver, and others. 

In addition, as an application range, the function of 
5 an unauthorized- alteration detecting method according to the 
present invention or an unauthorized-alteration detecting 
program according to the present invention and its execution 
function can be provided for various image input apparatuses 
such as digital cameras and scanners to embed watermarking 
10 information into images read by the apparatuses. 

Industrial Applicability 

According to the present invention, an unauthorized- 

15 alteration detecting method, an unauthorized-alteration 
detecting program, and a recording medium having recorded 
the program, which use a fragile electronic watermarking 
method employing the number theoretic transform, to which a 
robust electronic watermarking method employing orthogonal 

20 transform has been applied can be proposed. In addition, 
according to the present invention, an unauthorized- 
alteration detecting method and others capable of easily and 
visually checking whether unauthorized alteration was made 
and the position thereof can be proposed. 

25 In conventional electronic watermarking methods 

employing the number theoretic transform, signature 
information is embedded by replacing a relatively small 
range of two lowest order bits or so in the image bits of 
the original image. In contrast, in the present invention, 

30 security can be further enhanced by embedding signature 
information by using all or a desired large range of pixel 
bits of the original image. In the conventional methods 
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employing the number ' theoretic transform, signature 
information is embedded by multiplying ( convoluting ) into a 
number theoretic transform domain. In contrast, in the 
present invention, the calculation speed can be increased 
with smaller numerical errors by embedding signature 
information by additions. 



